If anywhere should be more tolerant of intellectual curiosity, it should be in a college environment.

Unless they can prove he had intent to cause damage, which it sounds like they could not do, they should just forgive and forget and stop trying to cover the overpaid butts of the sysadmin who didn't fix the hole in the first place.

Hell society forgave all the banks and wallstreet for their actual crimes.